What exactly occurs when selecting windows "Install Updates and shut down" logoff option?

Question

When updates are available and the user selects Shut Down from the Windows start menu, a dialog appears with a menu for Shutdown, Log Off etc.

One option which appears is

"Install Updates And Shut Down"

The question is, what exactly happens when the user presses OK?

Is the task showing the dialog Explorer? (It seems impossible to tell with process monitor spying, because the desktop is frozen)

I assume (But am not sure) this is Explorer and when the user presses OK it calls ExitWindowsEx

If So the question is what is different when the user selects "Install Updates And Shut Down" would it send special flags to ExitWindowsEx or perhaps call another API and would there be any way to spy this functionality?

Answer 1

when the user clicks "ok", it logs out every connected user then it installs all pending updates. the update installation process does not execute in explorer. i think it executes under WinLogon, maybe through a Winlogon notification package. i don't know which system call would trigger this behaviour automatically...

however, you can have a look at the Windows Update Agent API which should allow you to control automatic updates programmatically.

Answer 2

Im just throwing out some thoughts..

Maybe it puts an entry in this registry key before restarting: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce

Also check out the value ShutdownFlags in the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon